Searched hist:"8961 be33e8ca7e809c603223803ea66ef7ea5be7" (Results 1 – 1 of 1) sorted by relevance
| /openbmc/qemu/ |
| H A D | block.c | diff 8961be33e8ca7e809c603223803ea66ef7ea5be7 Thu Sep 06 09:25:41 CDT 2018 Alberto Garcia <berto@igalia.com> block: Fix use after free error in bdrv_open_inherit()
When a block device is opened with BDRV_O_SNAPSHOT and the
bdrv_append_temp_snapshot() call fails then the error code path tries
to unref the already destroyed 'options' QDict.
This can be reproduced easily by setting TMPDIR to a location where
the QEMU process can't write:
$ TMPDIR=/nonexistent $QEMU -drive driver=null-co,snapshot=on
Signed-off-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|